Your privacy is important to us. This privacy statement explains the personal data RUKISHA (“RUKISHA”) collects, how RUKISHA processes it, and for what purposes. This statement should be read together with the Terms and Conditions of Use for other RUKISHA products and services. Where there is a conflict, this statement will prevail. This statement applies to all customers, suppliers, agents, merchants, dealers and all visitors frequenting any of RUKISHA premises.

References to

• 2.1 “You” means:
i)customer- the person who subscribes to, uses or purchases any of our products and services or accesses our websites and includes any person who accesses any of the products and services you have subscribed to.
• ii)Any agent, dealer and/or merchants who has signed an agreement with us and is recognised as a merchant or agent in accordance with any applicable laws or Regulations.
• iii) Any visitor that is a person (including contractors/subcontractors or any third parties) who gains access to any RUKISHA premises.
• iv)Any supplier who has been contracted by RUKISHA and executed a Supplier contract.

• 3.1.1 We collect your personal information with your knowledge and consent when you do any of the following (please note that this list is not exhaustive):
• b) buy, subscribe to or use a Rukisha product or service online, on the cloud, on a mobile or other device.
• c) ask Rukisha for more information about a product or service or contact RUKISHA with a query or complaint;
• d) respond to or participate in a survey, marketing promotion, prize competition or special offer;
• e) visit, access or use RUKISHA or third-party websites;
• f) We may also collect your information from other organisations including credit-reference bureaus, fraud prevention agencies and business directories;
• g) We may collect your information when you interact with us as a supplier, agent, merchant or dealer as prescribed in this statement;
• h) We also collect information when you visit any of our premises.

• 3.1.2 We do not onboard minors (any person under 18 years of age) except where you additionally register on their behalf as their parent and/ or legal guardian. If you allow a child to use our services, you should be aware that their personal information could be collected as described in this statement.

The information we collect and store about you includes but is not limited to the following:

• Your name, phone number, identity document type and number, email address.
• Your transaction information when you use our RUKISHA service.

We may use and analyse your information for the following purposes:

• Processing products and services that you have bought from RUKISHA.
• Responding to any of your queries or concerns;
• Verifying your identity information through publicly available and/or restricted government databases in order to comply with applicable regulatory requirements;
• Carrying out credit checks and credit scoring;
• Keeping you informed generally about new products and services and contacting you with offers
• to comply with any legal, governmental or regulatory requirement or for use by our lawyers in connection with any legal proceedings;
• In business practices including to quality control, training and ensuring effective systems operations
• Preventing and detecting fraud or other crimes and for debt recovery;
• For research, statistical, survey and other scientific or business purposes;
• Provide aggregated data (which do not contain any information which may identify you as an individual) to third parties for research and scientific purpose
• Administer any of our online platforms/websites.

Categories of Personal Data as defined in the Data Protection Act of Kenya may be processed depending on the particular types of products and services you have subscribed to.

We will process your personal information based on any of the lawful basis provided for under the Data Protection Law:

3.5.1 The performance of a Product/Service Agreement with you;

3.5.2 RUKISHA’s legitimate business interests;

3.5.3 Compliance with a mandatory legal obligation;

3.5.4 Consent you provide;

3.5.5 Public interest;

3.5.6 Your vital interest.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, the need to comply with our internal policy and the applicable legal, regulatory, tax, accounting or other requirements. Anonymised information that can no longer be associated with you may be held indefinitely.

4.1 Any disclosure of your information shall be in accordance with applicable law and regulations. RUKISHA shall assess and review each application for information and may decline to grant such information to the requesting party.

4.2 We may disclose your information to:

• a) law-enforcement agencies, regulatory authorities, courts or other statutory authorities in response to a demand issued with the appropriate lawful mandate and where the form and scope of the demand is compliant with the law.
• b) our subsidiaries, associates, partners, software developers or agents who are involved in delivering Rukisha products and services you order or use;
• c) Fraud prevention and Anti money laundering agencies, credit- reference agencies;
• d) publicly available and/or restricted government databases to verify your identity information in order to comply with regulatory requirements;
• e) debt-collection agencies or other debt-recovery organisations;
• f) Survey agencies that conduct surveys on behalf of RUKISHA;
• g) Emergency service providers when you make an emergency call (or where such disclosure to emergency service providers is necessary for your rescue, health and safety) including your approximate location;
• h) Any other person that we deem legitimately necessary to share the data with.

RUKISHA has put in place technical and operational measures to ensure integrity and confidentiality of your data via controls around: information classification, access control, cryptography, physical and environmental security and monitoring and compliance.

From time to time we may need to transfer your personal information outside the Republic of Kenya. Where we send your information outside Kenya, we will make sure that your information is properly protected in accordance with the applicable Data Protection Laws.

Subject to legal and contractual exceptions, you have rights under data protection laws in relation to your personal data. These are listed below: -

• a) Right to be informed that we are collecting personal data about you;
• b) Right to access personal data that we hold about you and request for information about how we process it;
• c) Right to request that we correct your personal data where it is inaccurate or incomplete;
• d) Right to request that we erase your personal data noting that we may continue to retain your information if obligated by the law or entitled to do so;
• e) Right to object and withdraw your consent to processing of your personal data. We may continue to process if we have a legitimate or legal reason to do so;
• f) Right to request restricted processing of your personal data noting that we may be entitled or legally obligated to continue processing your data and refuse your request;
• g) Right to request transfer of your personal data in [an electronic format].

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within reasonable time. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You have the right to lodge a complaint with the relevant supervisory authority that is tasked with personal data protection within the Republic of Kenya

RUKISHA shall have the right to terminate any agreement with you for failure to comply with the provisions of this statement and reject any application for information contrary to this statement.

RUKISHA reserves the right to amend or modify this statement at any time. If RUKISHA amends this statement, You can access the most current version of the privacy statement by clicking this link RUKISHA Privacy Statement so that you will always know how your personal information is being used or shared. Any amendment or modification to this statement will take effect from the date of notification on the RUKISHA website.

1st July 2021